Discover, Install, Update, Audit, and Remove Claude Code Plugins Safely

Quick answer

Install plugins only from a known marketplace or reviewed source, inspect every bundled skill, agent, hook, MCP/LSP server, script, and dependency, pin versions or commits where reproducibility matters, and test in an isolated repository. Use namespaced commands, disable overlapping plugins, review updates like code changes, and keep removal/recovery instructions. Anthropic's plugin discovery guide and plugin marketplace documentation define current commands and distribution behavior.

Understand the bundle you are installing

A plugin can package more than prompts:

• skills and commands that guide model behavior;
• subagent definitions with their own tools;
• hooks that execute at lifecycle events;
• MCP servers that expose external capabilities;
• LSP/code-intelligence integrations;
• executable scripts and dependencies;
• persistent state and update behavior.

The security review must cover the entire bundle. Reading only README.md is insufficient.

Review a marketplace and plugin

Before installation, verify:

1. Source repository and maintainer identity.
2. License, release history, and security reporting path.
3. Marketplace source and whether a plugin is pinned by version, tag, or SHA.
4. Manifest-declared components and any strict behavior.
5. Hook commands, MCP endpoints, environment access, and network destinations.
6. Scripts and dependency install steps.
7. Telemetry, retained data, and opt-out controls.
8. Namespace collisions with existing commands, agents, servers, or hooks.

An official marketplace improves discovery and provenance but does not eliminate the need for capability review.

Install and validate incrementally

Typical interactive commands follow this shape:

/plugin marketplace add owner/marketplace
/plugin install plugin-name@marketplace-name
/reload-plugins

Confirm current syntax in the plugin UI or docs. Then inspect the plugin manager, /mcp, /permissions, and /context. Exercise one expected workflow in a disposable branch. Verify that disabling the plugin removes its hooks and servers after the documented reload/restart boundary.

Control updates

Treat an update as a new executable supply-chain input. Review release notes and diff manifest, hooks, scripts, MCP configuration, dependencies, permissions, and data practices. Pin production or enterprise environments to a tested version or commit. Roll out to a small cohort, retain the previous version, and define rollback.

Avoid installing several broad workflow plugins at once. Their instructions and hooks may conflict while context consumption grows. Establish a baseline, add one plugin, measure outcomes, and keep only capabilities with clear value.

Audit and remove

Quarterly, inventory installed marketplaces/plugins, ownership, last update, capabilities, and actual use. Remove abandoned or redundant bundles. Deleting a plugin may not revoke OAuth grants, tokens, external webhooks, or data already stored; clean those up separately. Verify that cached or persistent state does not retain secrets.

Lab: plugin trust report

Choose one plugin. Produce a one-page report with source, version pin, components, tools, filesystem/network access, external data flow, update path, tests, telemetry, conflicts, and removal procedure. Install in isolation, verify two positive and two denied actions, then remove it and prove its capabilities are gone.

FAQ

Are plugins automatically active after installation?

Activation and reload behavior can vary by component and surface. Follow the plugin manager's current instructions and verify empirically.

What is the safest version strategy?

Pin a reviewed immutable commit for controlled environments, with an intentional process to evaluate and adopt updates.

Why are plugin commands namespaced?

Namespacing distinguishes components from different plugins and reduces collisions; use the documented full name in permissions and hooks.